With the API information and his controlled execution flow, Alex started to reverse-engineer the VM logic. He applied his understanding of the VMProtect IR and translated the VM instructions back into a higher-level representation.

His script spat out the first successfully lifted function:

| Method | Works on VMProtect 1.x | Works on VMProtect 3.x | |--------|------------------------|------------------------| | Static handler naming | Yes | No (virtualized handlers themselves) | | Hardware breakpoints | Yes | Partial (HRESUME checks) | | Full de-virtualization | 1-2 days | 2-4 weeks | | One-click unpacker | No | No |

In IDA/x64dbg: look for a loop with a large jmp table (handler dispatch).